Move away from legacy Azure Active Directory Graph to new Microsoft Graph

[drdamour]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

The provider currently uses the Azure Active Directory Graph which has been marked as legacy

My DevOps team doesn't like granting legacy permissions, suggest moving to the newer api's and permissions. This could be done in a backwards compatible way at first either with provider switch or through code that trys the first API and fallsback to the second.

New or Affected Resource(s)

probably a lot, but at least

• azuread_group
• azuread_user
• azuread_users

Potential Terraform Configuration

provider "azuread" {
  version = "=0.3.0"
  preferred_graph_api = "microsoft-graph" #or aad-graph
}

References

none

[sbkg0002]

This would be great!

[manicminer]

Thanks for raising this! The Azure SDK for Go currently only supports the Azure AD Graph API (graph.windows.net) and not Microsoft Graph (graph.microsoft.com). As you correctly state, the former is deprecated and over time more functionality is becoming available in the MS Graph API.

This has been raised upstream, see Azure/azure-sdk-for-go#7352

[dominik-lekse]

Can we pin this issue since it seems to affect a notable number of improvements of the provider?

Also, because an official Go SDK for the new Microsoft Graph API is not available at the time of writing, it effectively blocks the support for features in the provider which are only available in the Microsoft Graph API and not in the legacy Azure AD Graph API.

Are people from Microsoft involved in the improvement/development of this provider as it is the case for the azurerm provider?

[manicminer]

We have a roadmap for the provider which centers around building out MS Graph support, and we are actively tracking issues that directly depend on that support. I don't believe it makes sense to pin this issue as it's already readily searchable and there isn't any reference discussion here.

[rrey]

Is it possible to have an update on this ? We are currently forced to use another tool to handle the group creation because the Legacy API does not have enough fine grained permissions for our security team taste...

[manicminer]

Hello to all watching this thread. There's now a pinned issue explaining our plan and progress towards MS Graph support. I'm going to close this issue in favor of that one, please feel free to raise comments or questions there. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!